Submission Details
Severity:
missing validation When creating a new position in the veRAACToken.sol,
Summary
The maxTotalLocked variable in the contract is supposed to check for the max amount locked in contract. This check is missing when creating a new position/ increasing a previous position.
Vulnerability Details
It can be seen that the check for the MAXTOTAL_LOCK_AMOUNT is missing. This variable was initialized as 1B
function lock(uint256 amount, uint256 duration) external nonReentrant whenNotPaused {
if (amount == 0) revert InvalidAmount();
if (amount > MAX_LOCK_AMOUNT) revert AmountExceedsLimit();
if (totalSupply() + amount > MAX_TOTAL_SUPPLY) revert TotalSupplyLimitExceeded();
if (duration < MIN_LOCK_DURATION || duration > MAX_LOCK_DURATION)
revert InvalidLockDuration();
// Do the transfer first - this will revert with ERC20InsufficientBalance if user doesn't have enough tokens
raacToken.safeTransferFrom(msg.sender, address(this), amount);
// Calculate unlock time
uint256 unlockTime = block.timestamp + duration;
// Create lock position
_lockState.createLock(msg.sender, amount, duration);
_updateBoostState(msg.sender, amount);
// Calculate initial voting power
(int128 bias, int128 slope) = _votingState.calculateAndUpdatePower(
msg.sender,
amount,
unlockTime
);
// Update checkpoints
uint256 newPower = uint256(uint128(bias));
_checkpointState.writeCheckpoint(msg.sender, newPower);
// Mint veTokens
_mint(msg.sender, newPower);
emit LockCreated(msg.sender, amount, unlockTime);
}
function _initializeLockParameters() internal {
_lockState.minLockDuration = MIN_LOCK_DURATION; // 365 days
_lockState.maxLockDuration = MAX_LOCK_DURATION; // 1460 days (4 years)
_lockState.maxLockAmount = MAX_LOCK_AMOUNT; // 10M
_lockState.maxTotalLocked = MAX_TOTAL_LOCKED_AMOUNT; // 1B
}
Impact
Users can deposit more than the 1B limit expected by the code
Tools Used
manual review
Recommendations
add the validation check in the veRAACToken.sol
Updates
Lead Judging Commences
inallhonesty 7 months ago
Submission Judgement Published Assigned finding tags:
`veRAACToken::lock` function doesn't check MAX_TOTAL_LOCKED_AMOUNT
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.